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Abstract 

Navigation  signal  integrity  is  paramount  for  aviation  and  safety  of  life  services.  Hitherto, 
GPS  signal  anomaly  alerting  has  been  provided  primarily  by  ground-based  augmentations. 
Significantly  improved  navigation  signal  integrity  and  quality  may  be  accomplished  by  on-board 
detection  and  correction,  within  stringent  time-to-alert  limits.  In  this  way,  most  GPS  signal 
errors,  of  which  the  timekeeping  system  anomalies  are  the  major  source,  could  be  eliminated.  It 
would  then  be  possible  to  provide  signal  integrity  innately  from  the  source  constellation  to 
specified  service  category  levels  that  are  enhanced  to  meet  the  integrity  metrics  of  hazardously 
misleading  information,  time-to-alert,  availability,  continuity,  and  accuracy.  The  method  is  to 
continuously  monitor  multiple  atomic  frequency  standards  with  time-difference  measurements 
against  each  other  on-board  the  satellites,  using  existing  components  present  in  GPS 
architecture  in  a  method  similar  to  that  routinely  done  in  timing  labs  throughout  the  world. 

We  focus  in  this  paper  on  the  issue  of  detecting  and  alleviating  GPS  clock  anomalies  by  use 
of  actual  data  illustrating  frequency  breaks  in  GPS  clocks.  These  frequency  breaks  are  derived 
from  data  taken  in  ground  tests  of  Block  IIR  and  Block  IIF  clocks.  We  also  include  some 
frequency  breaks  derived  from  on-orbit  data.  Using  these  data,  we  discuss  how  on-board 
measurements  could  be  used  to  detect  and  mitigate  problems,  while  also  meeting  stringent  time- 
to-alert  limits,  such  as  6  s  or  shorter. 
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INTRODUCTION:  SIGNAL  INTEGRITY 

A  key  requirement,  signal  integrity  for  aviation  and  other  safety  critical  services,  has  several  components, 
such  as  the  time-to-alert  (TTA),  probability  of  hazardously  misleading  information  (HMI),  service 
availability,  and  continuity.  TTA  refers  to  the  necessity  of  providing  timely  warning  to  the  users  when 
the  system  is  degraded  and  should  not  be  used.  HMI  faults  could  result  from  the  failure  to  detect  a 
broadcast  of  misleading  information  or  a  failure  to  broadcast  an  alarm  about  misleading  information 
within  the  TTA.  High  signal  service  availability  with  continuity,  along  with  attributes  mentioned  above, 
are  required  for  dependable  operation.  Anomalous  behavior  of  GPS  clocks  has  been  shown  to  be  the 
major  source  of  GPS  HMI.  This  paper  discusses  the  use  of  on-board  clock  monitoring  as  a  means  of 
alleviating  this  problem. 

The  current  GPS  by  itself  does  not  provide  adequate  levels  of  integrity,  continuity,  and  time-to-alert 
requirements  to  permit  primary  reliance  for  safety-of-life  applications.  Augmentation  systems  are  being 
developed  and  deployed  to  address  some  of  these  shortcomings  [1],  but  inherent  aspects  of  the  current 
architectures  make  it  difficult  to  achieve  required  performance  levels,  as  embodied  in  the  RTCA 
standards  [2,3].  An  important  objective  for  future  generations  of  satellite -based  navigation  is  to  meet  and 
exceed  the  service  guarantees  of  presently  provided  radio  navigation  aids,  such  as  the  instrument  landing 
system  (ILS),  the  VHF  omnidirectional  radio  range  (VOR),  and  Distance  measuring  equipment  (DME) 
[4].  Thus,  overcoming  the  limitations  of  ground-based  augmentation  systems  and  providing  service 
quality  consistent  with  FAA  standards  is  a  primary  requirement  of  a  next -generation  GPS  system. 

We  discuss  one  solution  to  this  dilemma:  an  on-board,  satellite-based  integrity  monitoring  system, 
proposed  by  some  authors  [5-7].  The  most  effective  monitor  of  the  satellite  signals  would  be  at  the 
source,  on-board,  where  the  signals  are  generated.  This  proximity  would  allow  rapid  failure  detection  and 
alerting  by  integrating  fault  detection  and  alerting  capabilities  within  the  satellite  platform,  where  most  of 
the  anomalies  arise,  as  revealed  by  the  Integrity  Failure  Modes  and  Effects  Analysis  (IFMEA)  study  [8, 
9].  The  necessary  features  of  such  a  monitoring  service  have  been  described  [10]  and  could  be 
implemented  on  a  space-based  platform. 

Because  the  satellite  clock  signal  is  the  basis  for  all  other  derived  signals,  detecting  and  removing  clock 
anomalies  eliminates  many  causes  of  signal  aberration.  Precisely  monitoring  clock  signals  normally 
requires  a  more  stable  reference  signal.  However,  a  rigorous  approach,  consistent  with  exacting  integrity 
criteria,  is  to  evaluate  the  performance  of  atomic  standards  by  combining  precise  phase  or  time 
comparison  between  multiple  clocks  of  similar  type. 


CLOCK  ANOMALY  DETECTION 

Fundamentally,  GPS  navigation  works  by  providing  synchronized  signals  from  known  locations  in  space. 
Both  the  signal  synchronization  and  the  satellite  positions  that  users  actually  receive  are  predictions  that 
have  been  uploaded  to  the  satellites  typically  as  much  as  24  hours  earlier.  While  these  data  sets  are 
currently  uploaded  nominally  once  per  day  to  each  satellite,  contingency  uploads  are  accomplished  more 
often.  Cross-link  data  transmissions  have  been  considered  as  a  means  of  shortening  the  period  between 
uploads.  With  this  method,  the  ground  control  station  uploads  the  data  for  the  entire  constellation  to  one 
satellite.  The  cross-link  communication  system  then  propagates  the  respective  data  to  each  member  of  the 
constellation.  These  predictions  are  based  on  pseudo-range  measurements  made  at  ground-based  monitor 
stations.  Nevertheless,  a  clock  anomaly  must  be  alerted  within  a  few  seconds  for  the  most  stringent 
requirements  of  aircraft  navigation.  The  Time-to-Alert  (TTA)  for  the  so-called  Category  I,  II,  and  III 
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levels  for  precision  approach  is  in  Table  1.  Current  methods  require  ground-based  augmentation  systems 
to  meet  this  need. 


Table  1.  RTCA  standards  for  aviation  integrity. 


Accuracy 

Integrity 

Continuity 

Probability 

Availability 

Phase  of  Flight 

(95%  error) 

Time  to 
Alert 

Alert 

Limit 

Prob  (HMI) 

(Loss  of 
Navigation) 

Threshold 

Objective 

LPV 

H:  16.0  m 

V:  6.0-4.0  m 

* 

H 

H:  40  m 

V:  35  m 

1.-2.  x  10. 7 
/approach 

1.-8.  x  10. 6  /  15 
sec 

0.99 

0.99999 

APV 

H:16  m 

V:  7.6  m 

H:  556 

m 

V:  20  m 

2.x  10. 7 
/approach 

-5 

5.  x  10.  /hour 

0.99 

0.99999 

Cat  I  Precision 
Approach 

H:  16  m 

V:  4.0-7.6  m 

L:  40  m 

V:  10-12 

m 

2.x  10. 7 
/approach 

-5 

5.  x  10.  /hour 

0.99 

0.99999 

Cat  II  Precision 
Approach 

H:  6.9  m 

V:  2.0  m 

H:  17.3 

m 

V:  5.3  m 

2.x  10. 9 
/approach 

4.xl0  */ 15  s 

0.99 

0.99999 

Cat  Ilia  Precision 
Approach 

H:  6.0  m 

V:  2.0  m 

H:  15.5 

m 

V:  5.3 

m 

2.x  10. 9 
/approach 

L:  2.  x  1 0  /30  s 

V:  2.  x  10  9/15  s 

0.99 

0.99999 

Continually  comparing  clocks  on-board  satellites  could  provide  dependable  measurements  to  detect 
impending  and  actual  clock  signal  failure,  meeting  the  most  stringent  TTA  requirements  directly  from  the 
satellites.  To  meet  these  requirements,  an  accurate  measurement  system  measuring  multiple  clocks 
simultaneously  is  a  key.  A  measurement  rate  significantly  faster  than  a  time-to-alert  requirement  would 
be  necessary  for  redundancy  in  this  critical  system.  For  example,  measuring  at  a  10  Hz  rate  would  allow 
repeated  measurements  to  increase  certainty  within  a  6  s  TTA  window.  For  isolation  of  the  fault,  at  least 
three  independent  sources  are  required  for  majority  voting. 

This  on-board  monitoring  capability  would  provide  an  immediate  detection  of  anomalies  in  the  on-line 
clock  and  provides  a  means  for  improved  Continuity  and  Availability.  The  resulting  status  could  be 
inserted  into  the  navigation  message  for  direct  broadcast  to  the  users  and  to  the  ground-segment 
monitoring  stations,  thereby  providing  a  real-time  alerting  capability  to  the  system.  The  data  associated 
with  the  fault  indication  could  also  be  telemetered  to  the  control  segment  for  diagnostic  and  remedial 
actions. 


CLASSIFICATIONS  OF  CLOCK  ANOMALIES 

Achieving  integrity  and  time-to-alert  requirements  for  aviation  and  space  requires  the  ability  to  detect  true 
anomalies  and  false  alerts  with  high  probability  to  avoid  occurrence  of  hazardously  misleading 
information  (HMI).  Clock  systems,  such  as  the  atomic  standards  on  GPS,  commonly  experience 
anomalies  and  deviations  that  can  be  damaging  from  an  integrity  perspective.  Deviations  seen  in  timing 
systems  include: 
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•  occasional  bad  or  outlier  points, 

•  phase  jumps  in  the  clock  system  that  later  return  to  stable  or  predictable  values, 

•  phase  jumps  in  the  clock  system  that  do  not  return  to  predicted  values, 

•  frequency  deviations  that  return  to  predicted  values,  and 

•  true  frequency  steps  that  remain  in  the  clock  performance. 

These  anomalous  effects  may  happen  singly  or  in  combination,  suddenly,  or  over  a  period  of  time.  Such 
serious  situations  related  to  satellite  clock  anomalies  can  be  resolved  by  detection  of  these  aberrations  on 
board,  where  the  clock’s  behavior  can  be  monitored  in  real  time  without  additional  noise  or  errors  added 
by  communication  and  measurement  from  the  ground.  To  this  end,  either  redundant  frequency  standards 
on  board,  use  of  cross-link  ranging  measurements,  or  both  are  necessary. 


ON-BOARD  SATELLITE  CLOCK  COMPARISONS 

At  present  in  the  GPS  Block  HR  satellite,  a  comparison  of  the  on-board  atomic  frequency  standard  (AFS) 
and  voltage -controlled  crystal  oscillator  (VCXO)  is  accomplished  at  the  subsystem  known  as  the  Time 
Keeping  System  (TKS)  [11,12].  The  interaction  between  the  VCXO  and  the  atomic  standard  has  been 
studied  by  a  simulation  of  the  control  loop.  The  resulting  stability  performance  was  studied  by  Wu 
[13,14].  The  results  show  that  the  performance  of  a  TKS  comparison  system  will  be  dominated  by  the 
VCXO  stability  to  a  period  possibly  over  1000  s.  This  short-term  noise  will  affect  the  system 
performance  as  well  as  the  ability  to  predict  the  clock  values.  In  addition,  the  stability  of  the  VCXO  is 
worse  than  the  AFS  after  about  60  s. 

To  mitigate  these  shortcomings,  multiple  atomic  frequency  standards  (AFS)  can  be  inter-compared  by 
running  them  simultaneously  and  measuring  their  differences.  At  least  two  AFS  should  be  compared  on¬ 
board  a  satellite.  When  two  AFS  on  board  show  a  difference  from  prediction  exceeding  an  integrity 
threshold,  the  question  of  which  clock  has  failed  is  indeterminate.  Thus,  the  system  must  respond  with  an 
integrity  failure  alert  to  provide  fail-safe  capability.  A  comparison  of  three  or  more  AFS  could  provide 
majority  voting  logic  to  determine  the  failed  system  and  switch  to  a  properly  functioning  clock.  This 
would  provide  fail-operational  capability,  increasing  availability  and  continuity.  Additionally,  cross-link 
ranging  could  possibly  be  used  to  provide  additional  AFS  comparisons  beyond,  perhaps,  two  AFS 
compared  on  board.  This  would  provide  failure  detection  on  the  satellite  leading  to  fail-safe  operation, 
with  cross-link  ranging  supporting  failure  recovery  and  continued  operation.  This  dual  approach  provides 
some  redundancy  and  risk  mitigation,  since  a  cross-link  system  might  have  less  chance  of  reliable  success 
than  an  on-board  measurement  system.  Such  a  system  might  support  TTA  requirements,  but  there  might 
be  a  delay  in  recovery  leading  to  less  support  of  continuity  and  availability  requirements. 

Regardless  of  how  clocks  are  monitored  in  space,  clock  stability  between  ground  updates  must  be  good 
enough  to  accurately  evaluate  the  transmitted  signals  and  provide  automatic  integrity  monitoring  with 
virtually  no  false  alerts  from  the  combined  system.  With  three  running,  on-board  AFSs,  occasional 
breaks  of  the  error  threshold  can  be  allowed  if  the  system  can  be  assured  of  transfer  to  another  AFS 
within  a  period  shorter  than  the  required  TTA.  With  only  two  AFSs  on  board  running  and  measured,  the 
frequency  standards  must  be  stable  enough  for  performance  well  below  the  required  peak  error  threshold 
between  uploads.  The  period  between  uploads  is  currently  nominally  1  day.  Studies  into  decreasing  the 
interval  between  updates  have  been  conducted  by  the  GPS  111  teams,  particularly  by  using  cross-link  data 
transfer. 

Shortening  the  update  interval  for  integrity  considerations  is  dependent  upon  the  cross-link  data  system 
operating  with  reliability  compatible  with  integrity  requirements.  For  example,  for  category  I  precision 
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approach  (CAT-I),  the  probability  of  a  navigation  message  data  anomaly  should  be  <  10  7.  The  capability 
of  the  system  to  maintain  integrity  monitoring  will  depend  to  a  degree  upon  the  update  interval  that  can  be 
supported  by  clock  stability.  For  longer  intervals  such  as  approaching  a  day,  a  more  stable  clock,  which 
could  maintain  the  integrity  threshold  time  offset  error  from  prediction  at  a  day,  is  required  for  GPS  111. 
Such  clocks  would  also  need  a  suitable  on-board  measurement  system  for  comparison,  as  discussed 
below. 

ADVANCED  DUAL-MIXER  MEASUREMENT  SYSTEM 

Direct  inter-comparison  and  resolution  can  be  precisely  performed  by  the  use  of  the  dual-mixer  technique, 
shown  in  Figure  1  below.  The  resolution  of  a  system  such  as  this  can  be  shown  to  be  considerably  more 
precise  than  a  phase  meter  only  approach  [15].  In  addition,  such  a  scheme  injects  no  noise  into  the  timing 
chain  to  degrade  the  stability  characteristics.  Dual-mixer  technology  is  discussed  elsewhere  [15]  and 
summarized  here.  The  effective  down-conversion  gain  of  the  measurement  is  the  ratio  of  the  nominal 
frequency,  v0,  divided  by  the  beat  frequency  Av.  If  the  nominal  frequency  is  v0  =  10  MHz  and  the  beat 
frequency  Av=  10  Hz,  then  the  down -con version  gain  is  lxlO6.  If  the  time  difference  of  the  beat  signal, 
AX  beat  ,  is  measured  with  a  Time-Interval  Counter  (TIC)  having  a  resolution  of  20  ns,  the  measurement  of 
clock  time  difference,  Ax,  implies  an  equivalent  theoretical  resolution  of  20  fs.  While  the  hardware 
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realization  of  this  mathematical  idealization  may  have  effects  that  limit  the  accuracy,  nevertheless,  the 
dual-mixer  approach  provides  a  high-accuracy  measurement  system  that  allows  the  characterization  of 
AFS  performance  in  space.  There  are  many  options  for  implementation  with  current  digital  technology, 
which  limit  hardware  distortions  and  optimize  weight,  power,  and  cost  [16]. 

The  basic  configuration  of  the  dual-mixer  shown  above  can  be  extended  to  measure  three  or  more 
oscillators  simultaneously. 


IMPACT  OF  FREQUENCY  STEPS  ON  SIGNAL  INTEGRITY 

The  Allan  and  Hadamard  Variances  are  typically  used  to  describe  the  stability  of  atomic  frequency 
standards.  However,  neither  is  well  suited  for  showing  the  effects  of  widely  spaced  frequency  breaks. 
This  is  because  these  variances  would  ideally  quantify  the  noise  levels  of  the  test  clocks  over  an  infinitely 
long  sample  period.  Breaks  such  as  the  ones  experienced  in  the  GPS  Block  HR  and  IIF  clocks  will  have 
little  effect  over  long  sample  periods  of  the  variances.  Variances  calculated  over  relatively  short  periods 
of  time  that  include  one  of  more  frequency  breaks  will  show  some  degradation. 

Another  way  to  look  at  the  effects  is  in  terms  of  unexpected  phase  runoffs.  A  frequency  break  of  1  x  10  13 
would  result  in  8.6  ns  of  time  error  (about  3  m  of  range  error)  over  24  hours.  In  normal  operations,  the 
GPS  Control  Segment  could  do  an  upload  to  correct  the  error.  Without  an  upload,  that  error  would 
continue  to  propagate.  Larger  frequency  breaks  could  also  cause  time  errors  exceeding  the  FAA  integrity 
limits.  Weiss,  Masarie,  Shome,  and  Beard  have  investigated  this  using  the  Block  HR  life  test  data 
[17,18],  as  we  discuss  below. 

The  integrity  failure  threshold  would  be  a  value  for  range  error  that  should  not  be  exceeded  without  an 
integrity  alert.  For  our  analysis,  we  take  the  value  of  0.7  m,  as  specified  in  the  GPS  System  Specification 
[19],  as  a  somewhat  reasonable  value  to  provide  aircraft  integrity  alerting  for  precision  approach.  In  the 
Figure  2  below,  we  take  the  requirement  of  0.7  m  and  compare  it  to  the  effect  produced  by  frequency 
steps.  The  frequency  steps  in  the  plots  above  would  have  crossed  the  0.7  m  threshold  after  a  few  hours. 
Consequently,  they  will  need  to  be  detected  and  corrected.  Risk  mitigation  would  suggest  developing  a 
clock  that  would  not  do  this. 

Integrity  Bound  and  the  Clock  Stability  Measurement 

A  number  of  dependent  factors  need  to  be  considered  for  trade-offs  and  accommodation,  when 
considering  clock  monitoring  for  anomaly  detection  and  integrity  assurance.  First,  note  that  atomic 
clocks  are  fundamentally  frequency  devices,  and  could  at  best  provide  a  Gaussian  distribution  of 
deviations  around  its  true  frequency,  with  a  noise  spectrum  consistent  with  a  white -noise  model  of 
frequency  modulation.  Even  in  this  ideal  case,  white  noise  in  frequency  would  integrate  to  a  random 
walk  in  the  time  of  the  clock.  Thus,  even  an  ideal  clock  would  randomly  walk  off  from  prediction  at 
some  rate. 
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Figure  2.  Expected  clock  deviations  due  to  frequency  errors  vs.  update  interval. 


Heightening  this  problem  is  the  fact  that  GPS  atomic  frequency  standards  rarely  produce  a  Gaussian 
distribution  of  deviations  from  prediction.  This  includes  the  rubidium  vapor  cell  standard  design  in  use 
for  Blocks  HR  and  IIF  and  planned  for  Block  III.  Distribution  of  clock  deviations  depends  on  the 
statistics  that  characterize  both  the  steady-state  performance  of  the  clock,  as  well  as  occasional  frequency 
departures  that  are  not  steady-state.  It  may  be  that  a  good  model  involves  separate  steady-state  statistics 
from  anomalous  behaviors  in  operating  clocks.  A  complete  evaluation  of  this  problem  for  GPS  clocks 
needs  to  be  done. 

With  a  Gaussian  model,  a  probability  of  10 1 ,  as  required  for  CAT-I,  is  reached  by  allowing  data  within 
5.33  standard  deviations.  Since  the  existing  clock  data  are  not  Gaussian,  and  since  we  are  planning  for 
the  performance  of  clocks  not  yet  made,  the  resulting  distribution  cannot  be  known.  To  allow  some 
analysis  of  clock  requirements  relative  to  an  integrity  error  threshold,  we  select  a  value  of  10  times  the 
deviation  as  a  reasonable  guess. 

A  second  concept  crucial  to  understanding  on-board  clock  monitoring  is  the  relationship  between  clock 
stability,  or  predictability,  and  the  update  interval.  The  longer  the  update  interval,  the  more  stringent  are 
the  requirements  for  clock  performance.  For  integrity  monitoring,  the  update  interval  must  be  realizable 
with  the  stringent  reliability  requirements  for  aviation  integrity.  Advanced  cross-link  data  systems  may 
achieve  uploads  every  hour  or  even  every  15  minutes,  but  perhaps  not  reliably  enough  in  a  new  system. 
Given  the  current  rate  of  one  upload  per  day,  it  is  prudent  to  design  to  meet  the  present  baseline  until 
future  systems  are  proven. 

A  third  assumption  is  that  of  the  integrity  failure  threshold.  This  would  be  a  value  for  range  error  that 
should  not  be  exceeded  without  an  integrity  alert.  For  analysis  here,  we  again  take  the  value  of  0.7  m,  as 
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specified  in  the  GPS  system  specification  [19],  as  a  somewhat  reasonable  value  to  provide  aircraft 
integrity  alerting  for  precision  approach. 

Figure  3  combines  these  concepts  to  illustrate  their  interaction  graphically.  The  figure  compares  the 
deviation  of  various  advanced  clocks  with  1/10  of  the  required  performance  to  meet  a  0.7  m  prediction 
error  threshold.  The  vertical  axis  is  the  Hadamard  deviation  of  a  clock,  a  statistic  chosen  because  it 
aliases  the  linear  frequency  drift  of  a  clock.  Thus,  assuming  the  drift  can  be  removed  operationally,  we 
compare  the  predictability  of  clocks  without  drift.  The  horizontal  axis  is  the  time  interval  between 
updates.  Thus,  we  see  the  stability  of  each  clock  as  a  function  of  the  interval  the  clock  would  be  required 
to  hold  performance.  A  clock  supports  the  error  threshold  in  the  plot  when  its  stability  curve  lies  below 
the  red  line. 

Thus,  we  see  that  all  of  the  clocks  illustrated  lie  below  the  ten-deviation  requirement  out  to  almost  1  day. 
This  model  implies  that  a  more  advanced  clock  would  be  required  to  support  a  true  1  -day  update  period. 
The  estimated  IIF  Rubidium  Atomic  Frequency  Standard  (RAFS)  and  the  performance  required  for  the 
Advanced  Technology  Atomic  Frequency  Standard  (ATAFS)  clocks  lie  below  the  red  bound  for  a  15- 
minute  update  period  and  stay  below  out  to  about  a  half-day  update  period.  With  a  more  stable  advanced 
clock,  it  would  be  possible  to  achieve  the  required  stability  with  the  present  operational  mode  of  1-day 
update  period. 


——  0.1  of  Integrity  Failure  at  0.7  m 

♦  ATAFS  Performance  Goal 

— * —  Symmetricom  Optically  pumped  CAFS, 
experimental 

IIF  RAFS  possible  performance 
Potential  for  Advanced  Clock 
1  Best  Cross-Link  Noise 


Figure  3.  Clock  stability  and  cross-link  measurement  in  support  of  GPS  III  integrity.  A 
clock  holds  stability  in  support  of  0.7  m  error  threshold  when  its  stability  lies  below  the 
red  line,  as  discussed  in  the  text. 
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We  see  also  in  Figure  3  that  an  advanced  cross-link  ranging  system  could  support  a  1/10  of  0.7  m 
threshold  by  comparing  clocks  among  adjacent  satellites  at  update  rates  of  up  to  1/day.  The  noise  of 
cross-link  measurements  may  be  closer  to  Gaussian  than  is  clock  noise.  However,  the  speed  of  cross-link 
measurements,  which  is  not  addressed  in  this  noise  estimate,  would  have  to  be  fast  compared  to  the  TTA. 


SUMMARY  OF  GPS  HR  FREQUENCY  STEPS 

NRL  performed  a  life  test  of  two  GPS  IIR  RAFS  units  over  a  7-year  period  ending  in  2004.  Both  clocks 
were  operated  in  a  simulated  space  environment,  and  all  available  telemetry  points  were  recorded.  The 
13.4  MHz  outputs  were  continuously  compared  to  the  NRL  reference  clocks.  Neither  of  the  units  failed 
in  that  test  period,  but  both  exhibited  frequency  steps.  Unit  serial  number  28  started  with  a  repeating 
sequence  of  positive  and  negative  steps  which  lasted  the  first  4  years  of  the  test  (Figure  4).  At  that  point, 
unit  28  experienced  a  2  x  10  12  step  and  the  pattern  ended.  It  had  another  similar  step  a  few  months  later. 

The  second  IIR  life  test  unit,  serial  number  30,  also  had  frequency  steps,  but  they  were  smaller,  less 
frequent,  and  not  periodic  (Figure  5).  As  part  of  the  life  test,  high  resolution  telemetry  data  were 
collected  for  both  test  clocks.  For  the  periodic  steps  in  RAFS  28,  correlating  changes  were  seen  in  the 
second  harmonic  and  light  telemetry  monitors.  It  is  interesting  to  note  that  many  of  the  breaks  occurred 
in  a  sequence  of  three  distinct  breaks  over  a  period  of  several  days.  During  the  period  between  the  first 
and  third  breaks,  the  frequency  drift  rate,  aging,  is  different. 


CUMULATIVE  DISCONTINUITIES  IN  THE  FREQUENCY  OFFSET  OF  RAFS  S/N  28 
Naval  Research  Laboratory 
Precision  Clock  Evaluation  Facility 
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Figure  4.  Cumulative  discontinuities  in  the  frequency  offset  of  IIR  RAFS  S/N  28. 
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CUMULATIVE  DISCONTINUITIES  IN  THE  FREQUENCY  OFFSET  OF  RAFS  30 
Naval  Research  Laboratory 
Precision  Clock  Evaluation  Facility 
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Figure  5.  Cumulative  discontinuities  in  the  frequency  offset  of  HR  RAFS  S/N  30. 


A  preliminary  study  of  peak  deviation  from  prediction  in  the  two  GPS  HR  life-test  RAFS  was  done 
previously  [18].  Over  a  period  of  150  d.  units  28  and  30  held  predicted  time  as  in  Table  2  below.  The 
deviations  for  serial  number  (S/N)  28  were  due  primarily  to  frequency  steps,  typically  worse  in  negative 
values  than  in  positive.  For  S/N  30,  the  deviations  were  largely  due  to  the  mean  frequency  not  being  at 
the  center  of  the  distribution.  S/N  30  had  a  bimodal  distribution  of  frequency  deviations,  a  main  one  and 
a  smaller  one  with  a  different  mean  value. 


Table  2.  Peak  deviation  from  prediction  in  ns  from  150  d  of  life-test  data. 


S/N  28 

S/N  30 

15  minutes 

1.5 

0.4 

1  hour 

6 

0.5 

2  hours 

12 

0.7 

4  hours 

25 

1.0 

8  hours 

50 

1.5 

1  day 

150 

4 

SVN  43,  the  first  successful  HR  launch,  displayed  similar  performance,  as  seen  in  the  on-orbit  data  in 
Figure  6.  Table  3  summarizes  the  Block  HR  repetitive  frequency  breaks.  It  is  difficult  to  observe  these 
correlations  in  the  on-orbit  telemetry  data,  due  to  the  limited  resolution  of  the  telemetry.  To  date,  24 
Block  IIR/IIRM  clocks  have  been  activated,  with  only  the  nine  shown  in  Table  3  exhibiting  frequency 
steps  having  a  cyclic  period. 
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CUMULATIVE  FREQUENCY  DISCONTINUITIES  OF  NAVSTAR  SVN  43  Rb  SN  06 
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Figure  6.  Cumulative  discontinuities  in  the  frequency  offset  of  IIR  RAFS  S/N  06. 


Table  3.  Summary  of  Block  IIR  on-orbit  repetitive  frequency  breaks. 


Space  Vehicle 
Number 

Frequency  Break 
Parts  in  10(14) 

Cyclic  Period 
(days) 

Plane 

43 

8 

19 

F 

44 

20 

3 

B 

45 

23 

22 

D 

46 

18 

13 

D 

47 

50 

10 

E 

53 

20 

15 

C 

54 

15 

28 

E 

57 

23 

12 

C 

59 

7 

9 

C 
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Historically,  frequency  steps  in  rubidium  clocks  are  blamed  on  the  rubidium  lamp  that  creates  the 
spectrally  filtered  light  used  to  interrogate  the  rubidium  atomic  resonance.  If  a  clock  showed  steps, 
replacing  the  lamp  usually  reduced  the  number  of  steps.  However,  there  were  no  real  criteria  for 
determining  a  good  lamp  from  a  bad  one  other  than  operating  it  in  a  clock  for  a  lengthy  period.  Even 
then,  steps  did  occur,  just  at  a  lower  rate  or  amplitude. 


BLOCK  IIF  RAFS  LIFE  TEST  CLOCK  BEHAVIOR 

Several  changes  have  been  made  in  the  design  of  the  Block  HR  clock  for  Block  IIF.  In  addition  to 
modifying  the  clock  to  output  10.23  MHz,  there  were  also  changes  to  the  gas  mixture  used  in  the 
rubidium  lamp  and  other  relatively  small  changes  in  the  physics  unit.  Two  IIF  RAFS  units  are  currently 
in  life-test  at  facilities  at  NRF.  They  have  both  shown  frequency  steps  at  1 8  months  into  the  test  period. 
The  largest  step  of  the  six  steps  reported  on  clock  serial  number  5  was  +7.0  x  10  l4.  For  serial  number 
25,  the  two  steps  were  reported  with  the  larger  being  -3.5  x  10  14.  These  are  clearly  much  smaller  than 
what  was  seen  in  the  HR  test.  Neither  clock  is  showing  any  pattern  to  its  steps.  Figure  7  shows  the  steps 
for  both  clocks.  Both  of  the  steps  on  unit  25  showed  apparent  correlation  between  the  telemetry  and  the 
frequency  steps.  An  example  is  MJD  55192,  where  the  second  harmonic  shifted  at  the  same  time  the 
frequency  stepped.  There  was  no  change  in  the  light  monitor.  The  last  step  on  each  clock  was  associated 
with  a  change  in  chamber  pressure  due  to  vacuum  pump  maintenance. 
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Figure  7.  Frequency  step  history  for  IIR  RAFS,  S/N  5  and  25. 


The  IIF  RAFS  life  test  has  shown  another,  more  unusual  frequency  change  characteristic.  RAFS  5 
experienced  a  change  of  drift  rate  over  a  period  of  several  days,  resulting  in  a  net  frequency  shift  of  about 
+  1  x  10  l3.  The  clock  had  been  drifting  negative  at  6.9  x  10  14/day  when  it  shifted  to  a  drift  rate  of  +1  x 
10  14/day.  Two  days  later,  it  shifted  back  to  the  initial  drift  rate.  What  differentiates  this  behavior  from  a 
typical  frequency  step  is  that  it  takes  several  days  to  complete  the  event.  The  phase  plot,  Figure  8,  would 
normally  show  a  sharp  point  at  the  point  where  the  frequency  changes. 
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An  on-board  system  would  be  able  to  detect  such  irregular  changes  in  behavior  and  compensate 
accordingly  to  maintain  timekeeping  system  performance  within  the  required  invariability  for  long-term 
signal  integrity. 


Figure  8.  Phase  change  reversal.  For  HR  RAFS  S/N  5. 


CONCLUSIONS 

We  have  presented  concepts  for  GPS  signal  integrity  assurance  directly  from  the  satellites,  where  the 
signal  is  generated.  A  cautious  development  approach  might  yield  considerable  advantages  for  users 
requiring  integrity  assurance. 

Achieving  GPS  III  signal  integrity  requires  a  robust  cross-link  system,  more  stable  atomic  frequency 
standards,  or  both  for  risk  mitigation.  Providing  Cat-I  directly  from  GPS  requires  providing  automatic 
anomaly  detection  on  board  the  space  vehicle  (SV).  Key  to  this  function  is  the  stability  of  the  on-board 
clock  between  uploads,  as  well  as  providing  an  on-board  measurement  system  capable  of  precisely 
measuring  multiple  clocks. 

Currently,  the  Control  Segment  normal  operational  mode  is  to  upload  from  the  ground  once  per  day. 
Reducing  this  upload  interval  significantly  would  require  a  more  precise  and  reliable  cross-link  system. 
However,  to  depend  on  cross-link  uploads  in  order  to  maintain  integrity  would  require  a  high  degree  of 
robustness  for  the  new  cross-link  system. 

The  concept  could  be  validated  by  a  relatively  modest  development  effort  demonstrating  that  a  time¬ 
keeping  system  could  be  employed  to  support  Cat  I  criteria.  This  system  could  continue  to  depend  on  1  - 


477 


42nd  Annual  Precise  Time  and  Tune  Interval  (PTTI)  Meeting 


day  uploads,  but  with  higher  accuracy,  signal  integrity,  and  quality,  while  providing  enhanced  robustness, 
redundancy,  and  risk  mitigation. 
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